Software access

Abstract

A networked computer system is disclosed comprising database (or other) 5 applications accessible over a network to users via terminals in which at least some users have restricted access (restricted access privileges) to the applications. A security system is incorporated in the network and provides a functional layer between the user's environment and the database (or other) applications environment. The security system insulates the user's environment from the environment of applications being accessed so that connection information is not available to the user in a form that would permit the circumvention of access privileges.

What is claimed is:  
     
       1. A security system for controlling access from a user station to selected data and/or one or more selected software processes, which security system comprises: 
       i) input means for receiving user inputs from the user station, which user inputs comprise at least user identification data and a data identifier for identifying selected data or software process(es);  
       ii) means for authenticating said at least user identification data received from said input means;  
       iii) data storage means for storing access restriction information for each authorized user, and connect information, in relation to the data and/or software process(es);  
       iv) translation means for translating the received data identifier to connect information suitable for locating the selected data or software process(es), using stored connect information in said data storage means after said means for authenticating authenticates the received user identification data or;  
       v) connection set up means for setting up a connection for providing access from the user station to the selected data or software process(es) after receiving the translated data identifier as the connect information from said translation means; and  
       vi) disconnect means for disconnecting a link between the security system and the user station once said connection has been set up between the user station and the selected data or software process(es).  
     
     
       2. A security system according to  claim 1 , wherein the connection set up means comprises means for transmitting the connect information via the user station to a selected database and/or software process, for use in setting up said connection. 
     
     
       3. A security system according to  claim 2  wherein the system further comprises encryption means for use by the connection set up means in encrypting the connect information prior to transmission. 
     
     
       4. A security system according to  claim 1 , wherein the system comprises at least two parts, each part having access to said authentication means, a first of said two parts comprising said input means for receiving the user identification data from a user station, the system further comprising: 
       vii) substitute login means to disconnect a connection between the first part and a user station and to trigger reconnection of the user station to the second of said two parts; and  
       viii) a second data storage means for storing identification data for use by said authentication means  
       wherein said substitute login means has access to said second data storage means and is arranged to supply the identification data from said second data storage means for use in said reconnection. 
     
     
       5. A security system according to  claim 4  wherein the second of said two parts comprises said second data storage means, said translation means, said connection setup means and said disconnect means. 
     
     
       6. A security system according to  claim 4  which further comprises an access information store and means for outputting to the user station at least one encrypted data file, said encrypted data file comprising access information in respect of a selected database or software process. 
     
     
       7. A security system according to  claim 6  wherein the second of said two parts comprises said access information store. 
     
     
       8. A security system according to  claim 6  wherein the access information store holds identifiers for data sets, or selections of software process functionality, and wherein inputs by more than one user, carrying different identification data, may trigger output of the same encrypted data file. 
     
     
       9. A security system according to  claim 6 , wherein the connection set up means comprises means for establishing new identification data for use in setting up the connection for providing access from the user station to the selected data or software process(es). 
     
     
       10. A security system as in  claim 1  which further comprises an access information store and means for outputting to the user station at least one encrypted data file, said encrypted data file comprising access information in respect of a selected database or software process. 
     
     
       11. A security system as in  claim 1 , wherein the connection set up means comprises means for establishing fresh identification data for use in setting up the connection for providing access from the user station to the selected data or software process(es). 
     
     
       12. A security system according to  claim 1  wherein the disconnect means are configured to allow the connection between the user station and the selected data or software process(es) to remain after the link to the user station has been disconnected.